Mac Archive Type Sniffing

chrome/utility/safe_browsing/mac/udif.h

Index: chrome/utility/safe_browsing/mac/udif.h
diff --git a/chrome/utility/safe_browsing/mac/udif.h b/chrome/utility/safe_browsing/mac/udif.h
index fbb17c9280743e2611deba7d9955657f8e175413..571affc002315f9dc1f429557a7c8827768c1732 100644
--- a/chrome/utility/safe_browsing/mac/udif.h
+++ b/chrome/utility/safe_browsing/mac/udif.h
@@ -23,6 +23,61 @@ namespace dmg {
 class ReadStream;
 class UDIFBlock;
 
+#pragma pack(push, 1)

[Robert Sesek, 2017/06/09 21:46:19]

Can this be left back in the .cc file now?

[mortonm, 2017/06/09 23:00:44]

I kept it in the .h since we want to maintain a private field (trailer_) that
stores the trailer for access in the future. For example, we will want to query
the DMG signature (and possibly other fields) and would rather not have to
re-parse the file if it had already been parsed. Does this make sense or is
there a better way to do this?

[mortonm, 2017/06/09 23:11:13]

I kept it in the .h since we want to maintain a private field (trailer_) that
stores the trailer for access in the future. For example, we will want to query
the DMG signature (and possibly other fields) and would rather not have to
re-parse the file if it had already been parsed. Does this make sense or is
there a better way to do this?

[Robert Sesek, 2017/06/12 16:38:39]

You can also heap-allocate it and store it as a unique_ptr member, and only
forward-declare the struct names.

[mortonm, 2017/06/12 18:31:16]

Done.

+
+// The following structures come from the analysis provided by Jonathan Levin
+// at <http://newosxbook.com/DMG.html>.
+//
+// Note that all fields are stored in big endian.
+
+struct UDIFChecksum {
+  uint32_t type;
+  uint32_t size;
+  uint32_t data[32];
+};
+
+// The trailer structure for a UDIF file.
+struct UDIFResourceFile {
+  static const uint32_t kSignature = 'koly';
+  static const uint32_t kVersion = 4;
+
+  uint32_t signature;
+  uint32_t version;
+  uint32_t header_size;  // Size of this structure.
+  uint32_t flags;
+  uint64_t running_data_fork_offset;
+  uint64_t data_fork_offset;
+  uint64_t data_fork_length;
+  uint64_t rsrc_fork_offset;
+  uint64_t rsrc_fork_length;
+  uint32_t segment_number;
+  uint32_t segment_count;
+  uuid_t segment_id;
+
+  UDIFChecksum data_checksum;
+
+  uint64_t plist_offset;  // Offset and length of the blkx plist.
+  uint64_t plist_length;
+
+  uint8_t reserved1[64];
+
+  uint64_t code_signature_offset;
+  uint64_t code_signature_length;
+
+  uint8_t reserved2[40];
+
+  UDIFChecksum master_checksum;
+
+  uint32_t image_variant;
+  uint64_t sector_count;
+
+  uint32_t reserved3;
+  uint32_t reserved4;
+  uint32_t reserved5;
+};
+
+#pragma pack(pop)
+
 // UDIFParser parses a Universal Disk Image Format file, allowing access to the
 // name, types, and data of the partitions held within the file. There is no
 // canonical documentation for UDIF, and not all disk images use UDIF (though
@@ -47,6 +102,11 @@ class UDIFParser {
   explicit UDIFParser(ReadStream* stream);
   ~UDIFParser();
 
+  // Parses the trailer structure. Only actually parses data from the file the
+  // first time it is called -- after that just returns the previous result when
+  // parsing was attempted.
+  bool ParseTrailer();
+
   // Parses the UDIF file. This method must be called before any other method.
   // If this returns false, it is not legal to call any other methods.
   bool Parse();
@@ -71,7 +131,7 @@ class UDIFParser {
   std::unique_ptr<ReadStream> GetPartitionReadStream(size_t part_number);
 
  private:
-  // Parses the blkx plist trailer structure.
+  // Parses the blkx plist structure.
   bool ParseBlkx();
 
   ReadStream* const stream_;  // The stream backing the UDIF image. Weak.
@@ -79,6 +139,8 @@ class UDIFParser {
   // All blocks in the UDIF image.
   std::vector<std::unique_ptr<const UDIFBlock>> blocks_;
   uint16_t block_size_;  // The image's block size, in bytes.
+  UDIFResourceFile trailer_;
+  bool trailer_successfully_parsed_;
 
   DISALLOW_COPY_AND_ASSIGN(UDIFParser);
 };